Update php Docker tag to v8.5.0

2025-12-07 02:10:57 +00:00
58 changed files with 131 additions and 223 deletions
--- a/.gitea/workflows/lint-test-docker.yaml
+++ b/.gitea/workflows/lint-test-docker.yaml
@@ -6,14 +6,12 @@ on:
      - main
    paths:
      - 'hosts/**'
-      - '!clusters/**'

  push:
    branches:
      - main
    paths:
      - 'hosts/**'
-      - '!clusters/**'

 env:
  BASE_BRANCH: "origin/${{ gitea.base_ref }}"
@@ -75,7 +73,6 @@ jobs:

            for path in $GIT_DIFF; do
              CHANGED_COMPOSE+=$(echo "$path")
-              CHANGED_COMPOSE+=$(echo " ")
            done

          else
@@ -87,13 +84,13 @@ jobs:
          if [ -n "${CHANGED_COMPOSE}" ]; then
            echo ""
            echo ">> Compose to Lint:"
-            echo "$(echo "${CHANGED_COMPOSE}" | sort -u)"
+            echo "$(echo "${CHANGED_COMPOSE[@]}" | sort -u)"

            echo "----"

            echo "changes-detected=true" >> $GITEA_OUTPUT
            echo "compose-dir<<EOF" >> $GITEA_OUTPUT
-            echo "$(echo "${CHANGED_COMPOSE}" | sort -u)" >> $GITEA_OUTPUT
+            echo "$(echo "${CHANGED_COMPOSE[@]}" | sort -u)" >> $GITEA_OUTPUT
            echo "EOF" >> $GITEA_OUTPUT
          else
            echo "changes-detected=false" >> $GITEA_OUTPUT
@@ -107,7 +104,7 @@ jobs:
          echo ">> Running dclint on changed compose files:"
          echo "$CHANGED_COMPOSE"

-          for compose in $CHANGED_COMPOSE; do
+          echo "$CHANGED_COMPOSE" | while read -r compose; do
            echo ">> Linting $compose ..."
            npx dclint $compose
          done
--- a/.gitea/workflows/lint-test-helm.yaml
+++ b/.gitea/workflows/lint-test-helm.yaml
@@ -6,14 +6,12 @@ on:
      - main
    paths:
      - 'clusters/cl01tl/helm/**'
-      - '!hosts/**'

  push:
    branches:
      - main
    paths:
      - 'clusters/cl01tl/helm/**'
-      - '!hosts/**'

 env:
  CLUSTER: cl01tl
@@ -50,7 +48,7 @@ jobs:
        uses: azure/setup-helm@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
-          version: v3.19.2
+          version: v3

      - name: Check Directories for Changes
        id: check-dir-changes
@@ -63,7 +61,6 @@ jobs:
          if [ "${{ github.event_name }}" == "pull_request" ]; then
            echo ""
            echo ">> Checking for changes in a pull request ..."
-            git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+"
            GIT_DIFF=$(git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
          else
            echo ""
@@ -78,7 +75,6 @@ jobs:

            for path in $GIT_DIFF; do
              CHANGED_CHARTS+=$(echo "$path" | awk -F '/' '{print $4}')
-              RENDER_DIR+=$(echo " ")
            done

          else
@@ -90,13 +86,13 @@ jobs:
          if [ -n "${CHANGED_CHARTS}" ]; then
            echo ""
            echo ">> Chart to Lint:"
-            echo "$(echo "${CHANGED_CHARTS}" | sort -u)"
+            echo "$(echo "${CHANGED_CHARTS[@]}" | sort -u)"

            echo "----"

            echo "changes-detected=true" >> $GITEA_OUTPUT
            echo "chart-dir<<EOF" >> $GITEA_OUTPUT
-            echo "$(echo "${CHANGED_CHARTS}" | sort -u)" >> $GITEA_OUTPUT
+            echo "$(echo "${CHANGED_CHARTS[@]}" | sort -u)" >> $GITEA_OUTPUT
            echo "EOF" >> $GITEA_OUTPUT
          else
            echo "changes-detected=false" >> $GITEA_OUTPUT
--- a/.gitea/workflows/render-manifests-automerge.yaml
+++ b/.gitea/workflows/render-manifests-automerge.yaml
@@ -191,7 +191,7 @@ jobs:

              echo ""
              echo ">> Formating rendered template ..."
-              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
+              echo "$TEMPLATE" | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'

              echo ""
              echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
--- a/.gitea/workflows/render-manifests-dispatch.yaml
+++ b/.gitea/workflows/render-manifests-dispatch.yaml
@@ -176,7 +176,7 @@ jobs:

              echo ""
              echo ">> Formating rendered template ..."
-              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
+              echo "$TEMPLATE" | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'

              echo ""
              echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
--- a/.gitea/workflows/render-manifests-merge.yaml
+++ b/.gitea/workflows/render-manifests-merge.yaml
@@ -196,7 +196,7 @@ jobs:

              echo ""
              echo ">> Formating rendered template ..."
-              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
+              echo "$TEMPLATE" | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'

              echo ""
              echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
--- a/.gitea/workflows/render-manifests-push.yaml
+++ b/.gitea/workflows/render-manifests-push.yaml
@@ -194,7 +194,7 @@ jobs:

              echo ""
              echo ">> Formating rendered template ..."
-              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
+              echo "$TEMPLATE" | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'

              echo ""
              echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
--- a/clusters/cl01tl/helm/argo-workflows/Chart.lock
+++ b/clusters/cl01tl/helm/argo-workflows/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 0.46.1
 - name: argo-events
  repository: https://argoproj.github.io/argo-helm
-  version: 2.4.19
+  version: 2.4.18
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 6.16.1
-digest: sha256:1f98e04526d7b61fa9ee690c46542bcc2ae6b69bf7619e1107a1592386de9bf2
-generated: "2025-12-07T03:02:14.909953853Z"
+digest: sha256:6cc24f6ce2b7f67c2eeab9bb6f64ebfedc082a2e809fc1f03f691f99a3006143
+generated: "2025-12-04T01:01:06.532396136Z"
--- a/clusters/cl01tl/helm/argo-workflows/Chart.yaml
+++ b/clusters/cl01tl/helm/argo-workflows/Chart.yaml
@@ -21,7 +21,7 @@ dependencies:
    version: 0.46.1
    repository: https://argoproj.github.io/argo-helm
  - name: argo-events
-    version: 2.4.19
+    version: 2.4.18
    repository: https://argoproj.github.io/argo-helm
  - name: postgres-cluster
    alias: postgres-17-cluster
--- a/clusters/cl01tl/helm/argocd/values.yaml
+++ b/clusters/cl01tl/helm/argocd/values.yaml
@@ -60,7 +60,7 @@ argo-cd:
    enabled: true
    auth: false
  redisSecretInit:
-    enabled: false
+    enabled: true
  server:
    replicas: 2
    extensions:
@@ -279,7 +279,7 @@ argo-cd:
        - description: Application has degraded
          send:
            - app-health-degraded
-          when: app.status.health.status == 'Degraded'
+          when: app.status.health.status == 'Degraded' and time.Now().Sub(time.Parse(app.status.health.lastTransitionTime).Minutes() >= 15
      trigger.on-sync-failed: |
        - description: Application syncing has failed
          send:
--- a/clusters/cl01tl/helm/authentik/Chart.lock
+++ b/clusters/cl01tl/helm/authentik/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 2025.10.2
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
+  version: 1.23.1
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 6.16.1
-digest: sha256:e6ea05d8bdb96164bc19da117078b5101f329ad5f1b461fa02f198bef45454f3
-generated: "2025-12-07T02:54:01.695741198Z"
+digest: sha256:c3bafb322ca02710c8f325fefef20678957a8c6fd86894e44e5e318997e5cb80
+generated: "2025-12-03T23:59:57.54998859Z"
--- a/clusters/cl01tl/helm/authentik/Chart.yaml
+++ b/clusters/cl01tl/helm/authentik/Chart.yaml
@@ -26,7 +26,7 @@ dependencies:
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.2
+    version: 1.23.1
  - name: postgres-cluster
    alias: postgres-17-cluster
    version: 6.16.1
--- a/clusters/cl01tl/helm/booklore/values.yaml
+++ b/clusters/cl01tl/helm/booklore/values.yaml
@@ -9,7 +9,7 @@ booklore:
        main:
          image:
            repository: ghcr.io/booklore-app/booklore
-            tag: v1.13.2
+            tag: v1.13.1
            pullPolicy: IfNotPresent
          env:
            - name: TZ
--- a/clusters/cl01tl/helm/code-server/Chart.lock
+++ b/clusters/cl01tl/helm/code-server/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 4.5.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
-digest: sha256:3cf78630cd7670e1157a87fc7ccbeca248ef4ced8a3170e69140ea3e1b0ff564
-generated: "2025-12-07T02:54:11.675097664Z"
+  version: 1.23.1
+digest: sha256:97b29950cc5c263835abebd7ef2ca9c98510eb4122b4a0877af6f305c4615673
+generated: "2025-12-05T17:03:32.780722525Z"
--- a/clusters/cl01tl/helm/code-server/Chart.yaml
+++ b/clusters/cl01tl/helm/code-server/Chart.yaml
@@ -23,6 +23,6 @@ dependencies:
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.2
+    version: 1.23.1
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/visual-studio-code.png
 appVersion: 4.100.2
--- a/clusters/cl01tl/helm/descheduler/values.yaml
+++ b/clusters/cl01tl/helm/descheduler/values.yaml
@@ -44,7 +44,7 @@ descheduler:
              thresholds:
                cpu : 80
                memory: 80
-                pods: 90
+                pods: 140
              evictableNamespaces:
                exclude:
                  - "kube-system"
@@ -55,11 +55,11 @@ descheduler:
              thresholds:
                cpu: 30
                memory: 30
-                pods: 50
+                pods: 90
              targetThresholds:
                cpu: 60
                memory: 40
-                pods: 80
+                pods: 100
        plugins:
          balance:
            enabled:
--- a/clusters/cl01tl/helm/directus/Chart.lock
+++ b/clusters/cl01tl/helm/directus/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 4.5.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
+  version: 1.23.1
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 6.16.1
-digest: sha256:73ab37385c3d0ec2db83a3640bc03b08ddd06fd015e1b7138e49bc8c3be9382e
-generated: "2025-12-07T02:54:20.639142398Z"
+digest: sha256:0d195cd3f8ac9e0a48b4c793a29b9a35f880aa2a695e605825109d3f461573f6
+generated: "2025-12-05T17:03:46.167997289Z"
--- a/clusters/cl01tl/helm/directus/Chart.yaml
+++ b/clusters/cl01tl/helm/directus/Chart.yaml
@@ -24,7 +24,7 @@ dependencies:
  - name: cloudflared
    alias: cloudflared-directus
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.2
+    version: 1.23.1
  - name: postgres-cluster
    alias: postgres-17-cluster
    version: 6.16.1
--- a/clusters/cl01tl/helm/element-web/Chart.lock
+++ b/clusters/cl01tl/helm/element-web/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 1.4.26
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
-digest: sha256:f9196cbede894c6da6ecedd9ae05d3f1fd0e20304eca8ca38c18334a923b2235
-generated: "2025-12-07T02:54:29.895481505Z"
+  version: 1.23.1
+digest: sha256:601cbb43296add7470b663f64b7bc18a2220d3cfff7bef397f72174929d9ff76
+generated: "2025-12-03T23:41:18.74872215Z"
--- a/clusters/cl01tl/helm/element-web/Chart.yaml
+++ b/clusters/cl01tl/helm/element-web/Chart.yaml
@@ -22,6 +22,6 @@ dependencies:
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.2
+    version: 1.23.1
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/element.png
 appVersion: v1.11.100
--- a/clusters/cl01tl/helm/freshrss/Chart.lock
+++ b/clusters/cl01tl/helm/freshrss/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 4.5.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
+  version: 1.23.1
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 6.16.1
-digest: sha256:d4b26fd1608a0c767c6ebb226173cef133ed53f45098851713121e429bc614a1
-generated: "2025-12-07T02:54:39.594902963Z"
+digest: sha256:9b9282efd9c59c36abcc2cad640a57a402f99474bd4154efcf4e6850a096b5ba
+generated: "2025-12-05T17:04:16.909780215Z"
--- a/clusters/cl01tl/helm/freshrss/Chart.yaml
+++ b/clusters/cl01tl/helm/freshrss/Chart.yaml
@@ -24,7 +24,7 @@ dependencies:
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.2
+    version: 1.23.1
  - name: postgres-cluster
    alias: postgres-17-cluster
    version: 6.16.1
--- a/clusters/cl01tl/helm/gatus/values.yaml
+++ b/clusters/cl01tl/helm/gatus/values.yaml
@@ -140,9 +140,6 @@ gatus:
      - name: audiobookshelf
        url: https://audiobookshelf.alexlebens.net
        <<: *defaults
-      - name: booklore
-        url: https://booklore.alexlebens.net
-        <<: *defaults
      - name: home-assistant
        url: https://home-assistant.alexlebens.net
        <<: *defaults
@@ -179,11 +176,6 @@ gatus:
      - name: n8n
        url: https://n8n.alexlebens.net
        <<: *defaults
-      - name: kronic
-        url: https://kronic.alexlebens.net
-        <<: *defaults
-        conditions:
-          - "[STATUS] == 401"
      - name: omni-tools
        url: https://omni-tools.alexlebens.net
        <<: *defaults
@@ -253,9 +245,6 @@ gatus:
      - name: ceph
        url: https://ceph.alexlebens.net
        <<: *defaults
-      - name: garage
-        url: https://garage-webui.alexlebens.net
-        <<: *defaults
      - name: pgadmin
        url: https://pgadmin.alexlebens.net
        <<: *defaults
@@ -265,29 +254,6 @@ gatus:
      - name: vault
        url: https://vault.alexlebens.net
        <<: *defaults
-      - name: backrest
-        url: https://backrest.alexlebens.net
-        <<: *defaults
-      - name: qui
-        url: https://qui.alexlebens.net
-        <<: *defaults
-      - name: qbittorrent
-        url: https://qbittorrent.alexlebens.net
-        <<: *defaults
-      - name: prowlarr
-        url: https://prowlarr.alexlebens.net
-        <<: *defaults
-      - name: huntarr
-        url: https://huntarr.alexlebens.net
-        <<: *defaults
-      - name: bazarr
-        url: https://bazarr.alexlebens.net
-        <<: *defaults
-        conditions:
-          - "[STATUS] == 401"
-      - name: tdarr
-        url: https://tdarr.alexlebens.net
-        <<: *defaults
      - name: sonarr
        url: https://sonarr.alexlebens.net
        <<: *defaults
@@ -318,11 +284,25 @@ gatus:
      - name: slskd
        url: https://slskd.alexlebens.net
        <<: *defaults
-      - name: ephemera
-        url: https://ephemera.alexlebens.net
+      - name: qui
+        url: https://qui.alexlebens.net
        <<: *defaults
-      - name: listenarr
-        url: https://listenarr.alexlebens.net
+      - name: qbittorrent
+        url: https://qbittorrent.alexlebens.net
+        <<: *defaults
+      - name: prowlarr
+        url: https://prowlarr.alexlebens.net
+        <<: *defaults
+      - name: bazarr
+        url: https://bazarr.alexlebens.net
+        <<: *defaults
+        conditions:
+          - "[STATUS] == 401"
+      - name: huntarr
+        url: https://huntarr.alexlebens.net
+        <<: *defaults
+      - name: tdarr
+        url: https://tdarr.alexlebens.net
        <<: *defaults
      - name: www
        url: https://www.alexlebens.dev
@@ -367,14 +347,24 @@ gatus:
        url: https://codeserver.alexlebens.dev
        <<: *defaults
        group: external
-      - name: authentik
-        url: https://auth.alexlebens.dev
-        <<: *defaults
-        group: external
      - name: public homepage
        url: https://home.alexlebens.dev
        <<: *defaults
        group: external
+      - name: discord
+        group: public
+        url: https://discord.com/app
+        conditions:
+          - "[STATUS] == 200"
+          - "[RESPONSE_TIME] < 400"
+        interval: 10s
+      - name: reddit
+        group: public
+        url: https://reddit.com
+        conditions:
+          - "[STATUS] == 200"
+          - "[RESPONSE_TIME] < 400"
+        interval: 10s
 postgres-17-cluster:
  mode: recovery
  cluster:
--- a/clusters/cl01tl/helm/gitea/Chart.lock
+++ b/clusters/cl01tl/helm/gitea/Chart.lock
@@ -13,9 +13,9 @@ dependencies:
  version: 0.17.2
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
+  version: 1.23.1
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 6.16.1
-digest: sha256:392636c97a9be96f21c70f9b53559398aa15e67a0cae551041ee64f23088b59a
-generated: "2025-12-07T02:54:49.861996743Z"
+digest: sha256:8850bad801d100185e4748ee90848d28c31c9e9e9e75da9051ee4da900e7e2af
+generated: "2025-12-05T17:04:42.441262591Z"
--- a/clusters/cl01tl/helm/gitea/Chart.yaml
+++ b/clusters/cl01tl/helm/gitea/Chart.yaml
@@ -41,7 +41,7 @@ dependencies:
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.2
+    version: 1.23.1
  - name: postgres-cluster
    alias: postgres-17-cluster
    version: 6.16.1
--- a/clusters/cl01tl/helm/gitea/templates/service-monitor.yaml
+++ b/clusters/cl01tl/helm/gitea/templates/service-monitor.yaml
@@ -12,6 +12,8 @@ spec:
    matchLabels:
      app.kubernetes.io/name: gitea
      app.kubernetes.io/instance: {{ .Release.Name }}
+    matchExpressions:
+      - { key: app.kubernetes.io/controller, operator: NotIn, values: [backup] }
  endpoints:
    - port: http

--- a/clusters/cl01tl/helm/gitea/values.yaml
+++ b/clusters/cl01tl/helm/gitea/values.yaml
@@ -174,9 +174,6 @@ gitea-actions:
 backup:
  global:
    fullnameOverride: gitea-backup
-    labels:
-      app.kubernetes.io/instance: gitea-backup
-      app.kubernetes.io/name: gitea-backup
  controllers:
    backup:
      type: cronjob
--- a/clusters/cl01tl/helm/home-assistant/values.yaml
+++ b/clusters/cl01tl/helm/home-assistant/values.yaml
@@ -9,7 +9,7 @@ home-assistant:
        main:
          image:
            repository: ghcr.io/home-assistant/home-assistant
-            tag: 2025.12.1
+            tag: 2025.12.0
            pullPolicy: IfNotPresent
          env:
            - name: TZ
--- a/clusters/cl01tl/helm/homepage-dev/Chart.lock
+++ b/clusters/cl01tl/helm/homepage-dev/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 4.5.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
-digest: sha256:fbfdebf734560044cfe5d2c4771b63cbcabc121d13c44b751f914877b5bdc83f
-generated: "2025-12-07T02:55:01.91141803Z"
+  version: 1.23.1
+digest: sha256:c376b4c3c32f4d2e60a64248073f971e0e78d21b016d75832f5deb504b1cec6b
+generated: "2025-12-05T17:05:10.9852779Z"
--- a/clusters/cl01tl/helm/homepage-dev/Chart.yaml
+++ b/clusters/cl01tl/helm/homepage-dev/Chart.yaml
@@ -22,6 +22,6 @@ dependencies:
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.2
+    version: 1.23.1
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/homepage.png
 appVersion: v1.2.0
--- a/clusters/cl01tl/helm/karakeep/Chart.lock
+++ b/clusters/cl01tl/helm/karakeep/Chart.lock
@@ -7,6 +7,6 @@ dependencies:
  version: 0.17.2
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
-digest: sha256:c291962defb9fb8614db91ea3eef795b2bdf82e0364595a27cbd335e7f9a3179
-generated: "2025-12-07T02:55:11.250839916Z"
+  version: 1.23.1
+digest: sha256:d322e5d85648cebd8d7bc6228b2d84904bfcea705e01ebecba1d2f2ed869f548
+generated: "2025-12-05T17:06:25.81244037Z"
--- a/clusters/cl01tl/helm/karakeep/Chart.yaml
+++ b/clusters/cl01tl/helm/karakeep/Chart.yaml
@@ -27,6 +27,6 @@ dependencies:
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.2
+    version: 1.23.1
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/webp/karakeep.webp
 appVersion: 0.26.0
--- a/clusters/cl01tl/helm/kubelet-serving-cert-approver/values.yaml
+++ b/clusters/cl01tl/helm/kubelet-serving-cert-approver/values.yaml
@@ -38,7 +38,7 @@ kubelet-serving-cert-approver:
        main:
          image:
            repository: ghcr.io/alex1989hu/kubelet-serving-cert-approver
-            tag: 0.10.1
+            tag: 0.10.0
            pullPolicy: Always
          args:
            - serve
--- a/clusters/cl01tl/helm/matrix-synapse/Chart.lock
+++ b/clusters/cl01tl/helm/matrix-synapse/Chart.lock
@@ -7,12 +7,12 @@ dependencies:
  version: 4.5.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
+  version: 1.23.1
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
+  version: 1.23.1
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 6.16.1
-digest: sha256:a90f6deb880962f642cac44608c3741af25c109464a62c9faf2f4552bfd2b920
-generated: "2025-12-07T02:55:22.440509182Z"
+digest: sha256:8a50907ebe63a29d2219d824391e0cd1ed76e80adc234d0bc4dd48414cc24a83
+generated: "2025-12-05T17:08:37.566169937Z"
--- a/clusters/cl01tl/helm/matrix-synapse/Chart.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/Chart.yaml
@@ -45,11 +45,11 @@ dependencies:
  #   version: 4.0.1
  - name: cloudflared
    alias: cloudflared-synapse
-    version: 1.23.2
+    version: 1.23.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: cloudflared
    alias: cloudflared-hookshot
-    version: 1.23.2
+    version: 1.23.1
    repository: oci://harbor.alexlebens.net/helm-charts
  - name: postgres-cluster
    alias: postgres-17-cluster
--- a/clusters/cl01tl/helm/n8n/values.yaml
+++ b/clusters/cl01tl/helm/n8n/values.yaml
@@ -9,7 +9,7 @@ n8n:
        main:
          image:
            repository: ghcr.io/n8n-io/n8n
-            tag: 1.123.3
+            tag: 1.123.1
            pullPolicy: IfNotPresent
          env:
            - name: GENERIC_TIMEZONE
@@ -93,7 +93,7 @@ n8n:
        main:
          image:
            repository: ghcr.io/n8n-io/n8n
-            tag: 1.123.3
+            tag: 1.123.1
            pullPolicy: IfNotPresent
          command:
            - n8n
@@ -188,7 +188,7 @@ n8n:
        main:
          image:
            repository: ghcr.io/n8n-io/n8n
-            tag: 1.123.3
+            tag: 1.123.1
            pullPolicy: IfNotPresent
          command:
            - n8n
--- a/clusters/cl01tl/helm/outline/Chart.lock
+++ b/clusters/cl01tl/helm/outline/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 4.5.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
+  version: 1.23.1
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 6.16.1
-digest: sha256:6ef789f9db4ad00ce2178a138c3c39a4e90eaef1e4244f52282bc0cb3094f4f5
-generated: "2025-12-07T02:55:32.91116723Z"
+digest: sha256:968e3af0f01ea3a0597f8bfb17e5f82145a3503bb500e4369f70911c5377e822
+generated: "2025-12-05T17:09:44.110984861Z"
--- a/clusters/cl01tl/helm/outline/Chart.yaml
+++ b/clusters/cl01tl/helm/outline/Chart.yaml
@@ -25,7 +25,7 @@ dependencies:
  - name: cloudflared
    alias: cloudflared-outline
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.2
+    version: 1.23.1
  - name: postgres-cluster
    alias: postgres-17-cluster
    version: 6.16.1
--- a/clusters/cl01tl/helm/postiz/Chart.lock
+++ b/clusters/cl01tl/helm/postiz/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 4.5.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
+  version: 1.23.1
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 6.16.1
-digest: sha256:6ed7bd8fa055ec4def561bbd391d49544a6cea8cef596b279845290b666d5316
-generated: "2025-12-07T02:55:42.350284796Z"
+digest: sha256:0a1164bd6ef443f53cf93365fab60ecd6bf2623bf612ee860449cc47301da723
+generated: "2025-12-05T17:10:43.908497892Z"
--- a/clusters/cl01tl/helm/postiz/Chart.yaml
+++ b/clusters/cl01tl/helm/postiz/Chart.yaml
@@ -23,7 +23,7 @@ dependencies:
    version: 4.5.0
  - name: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.2
+    version: 1.23.1
  - name: postgres-cluster
    alias: postgres-17-cluster
    version: 6.16.1
--- a/clusters/cl01tl/helm/postiz/values.yaml
+++ b/clusters/cl01tl/helm/postiz/values.yaml
@@ -9,7 +9,7 @@ postiz:
        main:
          image:
            repository: ghcr.io/gitroomhq/postiz-app
-            tag: v2.10.1
+            tag: v2.9.0
            pullPolicy: IfNotPresent
          env:
            - name: MAIN_URL
--- a/clusters/cl01tl/helm/qbittorrent/values.yaml
+++ b/clusters/cl01tl/helm/qbittorrent/values.yaml
@@ -28,7 +28,7 @@ qbittorrent:
        qbittorrent:
          image:
            repository: ghcr.io/linuxserver/qbittorrent
-            tag: 5.1.4@sha256:043498de39c3dd63eec94360c5ad966a51271d1581070f42cb73ab0cf4776f29
+            tag: 5.1.4@sha256:f0465dbb2aa14397fd205a0240ee562eb062354c036ccc444084fe46c6c75091
            pullPolicy: IfNotPresent
          env:
            - name: TZ
--- a/clusters/cl01tl/helm/rook-ceph/Chart.lock
+++ b/clusters/cl01tl/helm/rook-ceph/Chart.lock
@@ -7,6 +7,6 @@ dependencies:
  version: v1.18.8
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
-digest: sha256:22c958d439ac2f43c7bfd4a9544bc1f26ddd0758182173eef9dba4a9cf97bae3
-generated: "2025-12-07T02:55:52.670455114Z"
+  version: 1.23.1
+digest: sha256:28467614c6854e04a8733fb95b689d5a12f23878a030c56e529f06f490e5f9d8
+generated: "2025-12-03T21:00:36.655017976Z"
--- a/clusters/cl01tl/helm/rook-ceph/Chart.yaml
+++ b/clusters/cl01tl/helm/rook-ceph/Chart.yaml
@@ -24,6 +24,6 @@ dependencies:
  - name: cloudflared
    alias: cloudflared-rgw
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.2
+    version: 1.23.1
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ceph.png
 appVersion: v1.17.1
--- a/clusters/cl01tl/helm/searxng/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/searxng/templates/external-secret.yaml
@@ -1,28 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: searxng-wireguard-conf
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: searxng-wireguard-conf
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: private-key
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
-        metadataPolicy: None
-        property: private-key
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
  name: searxng-api-config-secret
  namespace: {{ .Release.Namespace }}
--- a/clusters/cl01tl/helm/searxng/templates/namespace.yaml
+++ b/clusters/cl01tl/helm/searxng/templates/namespace.yaml
@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: searxng
-  labels:
-    app.kubernetes.io/name: searxng
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/warn: privileged
--- a/clusters/cl01tl/helm/searxng/values.yaml
+++ b/clusters/cl01tl/helm/searxng/values.yaml
@@ -9,7 +9,7 @@ searxng:
        main:
          image:
            repository: searxng/searxng
-            tag: latest@sha256:7605237e3d06762975999b1310ea1e5e4d97e165a55a5cfe45abb87ee6830828
+            tag: latest@sha256:c25c6b671382f0464318b2de3b142f1c9fe3721e46fdad027f4d6caf399728ea
            pullPolicy: IfNotPresent
          env:
            - name: SEARXNG_BASE_URL
@@ -43,7 +43,7 @@ searxng:
        main:
          image:
            repository: searxng/searxng
-            tag: latest@sha256:7605237e3d06762975999b1310ea1e5e4d97e165a55a5cfe45abb87ee6830828
+            tag: latest@sha256:c25c6b671382f0464318b2de3b142f1c9fe3721e46fdad027f4d6caf399728ea
            pullPolicy: IfNotPresent
          env:
            - name: SEARXNG_BASE_URL
@@ -62,46 +62,6 @@ searxng:
            requests:
              cpu: 10m
              memory: 256Mi
-        gluetun:
-          image:
-            repository: ghcr.io/qdm12/gluetun
-            tag: v3.40.3@sha256:ef4a44819a60469682c7b5e69183e6401171891feaa60186652d292c59e41b30
-            pullPolicy: IfNotPresent
-          env:
-            - name: VPN_SERVICE_PROVIDER
-              value: protonvpn
-            - name: VPN_TYPE
-              value: wireguard
-            - name: WIREGUARD_PRIVATE_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: searxng-wireguard-conf
-                  key: private-key
-            - name: VPN_PORT_FORWARDING
-              value: "on"
-            - name: VPN_PORT_FORWARDING_UP_COMMAND
-              value: '/bin/sh -c "/gluetun/update.sh {{ printf "{{PORTS}}" }}"'
-            - name: PORT_FORWARD_ONLY
-              value: "on"
-            - name: FIREWALL_OUTBOUND_SUBNETS
-              value: 192.168.1.0/24,10.244.0.0/16
-            - name: FIREWALL_INPUT_PORTS
-              value: 8080
-            - name: DOT
-              value: "off"
-          securityContext:
-            privileged: True
-            capabilities:
-              add:
-                - NET_ADMIN
-                - SYS_MODULE
-          resources:
-            limits:
-              devic.es/tun: "1"
-            requests:
-              devic.es/tun: "1"
-              cpu: 10m
-              memory: 64Mi
  service:
    api:
      controller: api
--- a/clusters/cl01tl/helm/shelly-plug/values.yaml
+++ b/clusters/cl01tl/helm/shelly-plug/values.yaml
@@ -36,7 +36,7 @@ shelly-plug:
        main:
          image:
            repository: php
-            tag: 8.4.15-apache-bookworm
+            tag: 8.5.0-apache-bookworm
            pullPolicy: IfNotPresent
          env:
            - name: SHELLY_HOSTNAME
--- a/clusters/cl01tl/helm/site-documentation/Chart.lock
+++ b/clusters/cl01tl/helm/site-documentation/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 4.5.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
-digest: sha256:f312794ceabc62e757aaf8e89dcd0728dbd581414ad4c2bd07dbbe20bcba8c6a
-generated: "2025-12-07T02:56:04.029970498Z"
+  version: 1.23.1
+digest: sha256:4c473575970bcd562b85d566ef27477ece8e0d17602ab7b7faace8e96091a4ee
+generated: "2025-12-05T17:12:44.933210193Z"
--- a/clusters/cl01tl/helm/site-documentation/Chart.yaml
+++ b/clusters/cl01tl/helm/site-documentation/Chart.yaml
@@ -23,6 +23,6 @@ dependencies:
  - name: cloudflared
    alias: cloudflared-site
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.2
+    version: 1.23.1
 icon: https://d21zlbwtcn424f.cloudfront.net/logo-new-round.png
 appVersion: 0.8.1
--- a/clusters/cl01tl/helm/site-profile/Chart.lock
+++ b/clusters/cl01tl/helm/site-profile/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
  version: 4.5.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
-digest: sha256:b48981e2f4819b198c0584659579f958cb8e292c2ce08882a54224445e30e225
-generated: "2025-12-07T02:56:13.641921599Z"
+  version: 1.23.1
+digest: sha256:4bf6783f48235605d3682f39dcb5c936019961279261a903fbb42c0c308c00be
+generated: "2025-12-05T17:12:55.603709671Z"
--- a/clusters/cl01tl/helm/site-profile/Chart.yaml
+++ b/clusters/cl01tl/helm/site-profile/Chart.yaml
@@ -23,6 +23,6 @@ dependencies:
  - name: cloudflared
    alias: cloudflared-site
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.2
+    version: 1.23.1
 icon: https://d21zlbwtcn424f.cloudfront.net/logo-new-round.png
 appVersion: 2.0.1
--- a/clusters/cl01tl/helm/tubearchivist/templates/redis-replication.yaml
+++ b/clusters/cl01tl/helm/tubearchivist/templates/redis-replication.yaml
@@ -26,7 +26,7 @@ spec:
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
-            storage: 5Gi
+            storage: 1Gi
  redisExporter:
    enabled: true
    image: quay.io/opstree/redis-exporter:v1.48.0
--- a/clusters/cl01tl/helm/vaultwarden/Chart.lock
+++ b/clusters/cl01tl/helm/vaultwarden/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
  version: 4.5.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
-  version: 1.23.2
+  version: 1.23.1
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 6.16.1
-digest: sha256:7325b40362f6eeccd27a31b6d82b44aa3828b809a75b4ea8ecfd596cecebe855
-generated: "2025-12-07T02:56:23.769942213Z"
+digest: sha256:3e797938c47b12bbb55ad6f1e991cc2245ce884721a395b32c2a31d8b87963c5
+generated: "2025-12-05T17:15:20.144553691Z"
--- a/clusters/cl01tl/helm/vaultwarden/Chart.yaml
+++ b/clusters/cl01tl/helm/vaultwarden/Chart.yaml
@@ -25,7 +25,7 @@ dependencies:
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
-    version: 1.23.2
+    version: 1.23.1
  - name: postgres-cluster
    alias: postgres-17-cluster
    version: 6.16.1
--- a/clusters/cl01tl/helm/whodb/values.yaml
+++ b/clusters/cl01tl/helm/whodb/values.yaml
@@ -8,7 +8,7 @@ whodb:
        main:
          image:
            repository: clidey/whodb
-            tag: 0.82.0
+            tag: 0.81.0
            pullPolicy: IfNotPresent
          env:
            - name: WHODB_OLLAMA_HOST
--- a/hosts/ps08rp/traefik/compose.yaml
+++ b/hosts/ps08rp/traefik/compose.yaml
@@ -1,7 +1,7 @@
 ---
 services:
    traefik:
-        image: ghcr.io/traefik/traefik:v3.6.4
+        image: ghcr.io/traefik/traefik:v3.6.2
        container_name: traefik
        command:
            - "--global.checkNewVersion=false"
--- a/hosts/ps09rp/traefik/compose.yaml
+++ b/hosts/ps09rp/traefik/compose.yaml
@@ -1,7 +1,7 @@
 ---
 services:
    traefik:
-        image: ghcr.io/traefik/traefik:v3.6.4
+        image: ghcr.io/traefik/traefik:v3.6.2
        container_name: traefik
        command:
            - "--global.checkNewVersion=false"
--- a/hosts/ps10rp/traefik/compose.yaml
+++ b/hosts/ps10rp/traefik/compose.yaml
@@ -20,7 +20,7 @@ services:
            - /dev/net/tun:/dev/net/tun

    traefik:
-        image: ghcr.io/traefik/traefik:v3.6.4
+        image: ghcr.io/traefik/traefik:v3.6.2
        container_name: traefik
        command:
            - "--global.checkNewVersion=false"